CVE-2025-4222

The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is present, so a brute force attack would need to be successful in order to compromise any data.

• CWE-200

• https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-admin.php#L247
• https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-backup.php#L76
• https://www.guyshavit.com/post/cve-2025-4222
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fa452a9a-9e26-41a1-8dea-4bafaf735bee?source=cve

Published

May 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4216The DIOT SCADA with MQTT plugin for WordPress is vulnerable …6.4
• CVE-2025-4217The WP YouTube Video Optimizer plugin for WordPress is vulne…6.4
• CVE-2025-4218A vulnerability was found in handrew browserpilot up to 0.2.…7.8
• CVE-2025-4219The DPEPress plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2025-4220The Xavin's List Subpages plugin for WordPress is vulne…6.4
• CVE-2025-4221The Animated Buttons plugin for WordPress is vulnerable to S…6.4
• CVE-2025-4223The Page Builder: Pagelayer – Drag and Drop website builder …4.7
• CVE-2025-4224The wpForo + wpForo Advanced Attachments plugin for WordPres…7.2
• CVE-2025-4225An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2025-4226A vulnerability classified as critical has been found in PHP…9.8
• CVE-2025-4227An improper access control vulnerability in the Endpoint Tr…3.5
• CVE-2025-4228An incorrect privilege assignment vulnerability in Palo Alto…4.6